Category
Original research and datasets
7 posts
-
Who flagged it first? Public timestamps from nine 2025-2026 supply-chain incidents, from publish to KEV
Where public timestamps exist, malicious npm releases were flagged within minutes and pulled within about 3 to 5 hours. Open malware feeds caught up near removal time. CVEs and KEV listings came days to six months later.
-
Is OSV enough for agent artifacts? Measuring how many malicious MCP servers and skills appear in open malicious-package data
Of 10 documented agent-ecosystem incidents, 6 appear in the OpenSSF malicious-packages data. All 6 shipped through npm. None of the skill-store or GitHub-hosted incidents do, because OSV has no identifier for them.
-
The official MCP Registry has no security fields: what a registry listing does and doesn't tell you
An MCP Registry listing proves a publisher controls a namespace and, for packages, the package. It does not prove review, safe code, or control of a remote URL. The schema has no security field at all.
-
Do coding agents call optional security tools on their own? What the docs guarantee, and a 50-task test to run
Nothing in the MCP spec or Claude Code's docs makes an agent call a security-check tool before it installs something. The model decides. Here is why, and a pre-registered 50-task protocol to measure it on your own setup.
-
When agent-skill scanners disagree: what conflicting verdicts on the same skill mean for your install policy
In one census, auditors gave the same skill HIGH or CRITICAL and LOW or SAFE ratings on 1,233 listings, and 87.8% of listings had no audit at all. Treat conflict and absence of audit as separate policy states, not as a pass.
-
Why agent-security statistics disagree: a source-lineage audit of the MCP and skills numbers vendors quote
We traced ten widely quoted MCP and skills statistics to their origins. Most measure different things on different populations; two have no traceable source. A register with a safe-to-cite verdict for each.
-
The 2026 agent-ecosystem incident ledger: ten malicious skills, MCP servers and lures, sourced and dated
Ten publicly documented incidents, each traced to the finder's write-up or an advisory, fall into four repeat patterns. Lookalike MCP servers lead with five. Removal time is public for only two.
